Self-hosting with subdomains
jackdavies.github.io
If like me you have several self hosted services, one challenge you may face is having a easy way to access them, this can be extra challenging if you have a single non fixed IP address.

I created a short tutorial on using sub domains to access services hosted within my home network, thought I would share it here in case anyone finds it useful

This is the first time I’ve made a technical tutorial so apologise if there are mistakes/its confusing, feedback will be appreciated

  • frongt@lemmy.zipEnglish
    143·
    27 days ago

    I am once again recommending that you not expose any services to the internet except a VPN

      • LordKitsuna@lemmy.worldEnglish
        7·
        27 days ago

        I mean it WOULD work you would just need a von on every device you wanted to use.

        The REAL answer is never host them DIRECTLY, always use a reverse proxy like nginx. Many projects (i believe jellyfin is one of them) explicitly recommend this for better security. Which it looks like you did so congrats

        For extra bonus points you can setup nginx to run as a non privileged user and use iptables to forward the lower ports (80/443). A pain but closes out a large chunk of nginx as a risk.

          • LordKitsuna@lemmy.worldEnglish
            1·
            26 days ago

            Eh, i just use pubkey only Auth config (so password entirely disabled as an option) and put ssh on a non standard port to reduce script kid noise. (and no 2222 is not non-standard it may as well be the default)

            Fail2ban triggers false too often for my taste in a high traffic environment.

        • essell@lemmy.worldEnglish
          2·
          27 days ago

          Did you learn that about my jellyfin by looking at my post history or connecting to my server? 😀

          It’d struggle a bit on some setups, like when I’m using the Jellyfin app on my GFs smart TV… Or explaining to a friend in Europe how to setup a VPN without breaking anything else on his network… It is a risk for sure.

          I’m too tired right now to parse what you mean about the port forwarding. I guess the idea is to reduce the impact if Jellyfin were breached or exploited. If you’re up for it, can you explain more about why that relates to port forwarding?

          • LordKitsuna@lemmy.worldEnglish
            2·
            27 days ago

            If you ran nginx as a non privileged user it wouldn’t be able to bind to 80/443 as those are privileged ports. So you would need to use iptables to forward them to an unprivlaged port

            • essell@lemmy.worldEnglish
              1·
              27 days ago

              Ah, gotcha! Thanks.

              I feel like that information could have multiple implications in future. Thank you!

    • Aneb@lemmy.worldEnglish
      3·
      27 days ago

      Yeah it was honestly changing the router settings that was the hardest part for me, exposing port 22 and 80. Caddy was really easy to use

  • ragica@lemmy.mlEnglish
    5·
    27 days ago

    You seem to have descibed your port forwards backwards It is the router forwarding the ports to the gateway pi (and potentially other devices), not gateway pi and other devices forwarding to the router. The forwards to servers are incoming from the internet.

    (Theoretically you could have your pi physically between the router and the internet (modem) acting as a sort of pre-router, but this would be unusual. Perhaps you could describe your physical setup more clearly. What is physically/wirelessly connected to what, to the internet.)

  • pathos@lemmy.mlEnglish
    1·
    27 days ago

    Oh I thought it was sub domains for localhost. I actually wonder now if that’s possible.